#!/bin/bash

#****************************************************************#
# ScriptName: k8s-init.sh
# Author: Junhua Liao
# Create Date: 2020-11-27
# System: Centos 7.x
# Version: 
#***************************************************************#
# Initialize the machine. This needs to be executed on every machine.

SHDIR=$(cd `dirname $0`;pwd)

# Source function library.
. /etc/init.d/functions

Enable_ali_repo="0"          # 是否替换阿里云yum源, 0为开启, 非0为关闭, 国外可以不用开启
TimeZone="Asia/Shanghai"     # 默认为上海时区, 按需修改
Enable_docker="0"            # 是否启用docker 安装， 0 为启用, 非0为关闭
Containerd_Version="1.2.13"
Docker_Version="19.03.11"
Docker_BIP="172.17.0.1/24"   # 默认为docker的默认网段,有需求可以修改其他网段, 必须ip/网段写法, 172.18.0.1 将会为本机docker ip

#---------------------------------------------------------------#
# 查看版本
# yum list docker-ce --showduplicates 查看版本
# yum list containerd.io --showduplicates 查看版本
#---------------------------------------------------------------#

disable_selinxu () {
    setenforce 0
    sed -i 's/^SELINUX=.*/SELINUX=disabled/' /etc/selinux/config
    [[ $? == 0 ]] && action "Disable Selinxu ..." /bin/true || action "Disable Selinxu ..." /bin/false
}

# Add host domain name. please change you machine ip, if have rancher service, please add ...
change_hosts () {
cat > /etc/hosts << EOF
127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
::1         localhost localhost.localdomain localhost6 localhost6.localdomain6
192.168.80.21 k8s-01
192.168.80.30 k8s-02
192.168.80.31 k8s-03
192.168.80.22 rr.bcircle.app
EOF
[[ $? == 0 ]] && action "Change Hosts ..." /bin/true || action "Change Hosts ..." /bin/false

}

# 关闭firewalld
disable_firewalld () {
    systemctl stop firewalld
    systemctl disable firewalld
    [[ $? == 0 ]] && action "Disable Firewalld ..." /bin/true || action "Disable Firewalld ..." /bin/false
}

# 更改yum 源，国外可以不用执行
change_repo () {
    if [[ ${Enable_ali_repo} == "0" ]]; then
        yum install epel-release -y >/dev/null 2>&1
        yum install wget >/dev/null 2>&1
        mv /etc/yum.repos.d/CentOS-Base.repo /etc/yum.repos.d/CentOS-Base.repo.backup
        if [[ -f /etc/yum.repos.d/epel.repo ]]; then
            mv /etc/yum.repos.d/epel.repo /etc/yum.repos.d/epel.repo.backup
        fi
        wget -O /etc/yum.repos.d/CentOS-Base.repo http://mirrors.aliyun.com/repo/Centos-7.repo >/dev/null 2>&1
        wget -O /etc/yum.repos.d/epel.repo http://mirrors.aliyun.com/repo/epel-7.repo >/dev/null 2>&1
        yum clean all >/dev/null 2>&1
        yum makecache fast -y >/dev/null 2>&1
        [[ $? == 0 ]] && action "Ali Yum Repo Update ..." /bin/true || action "Ali Yum Repo Update ..." /bin/false
    fi
}

# 安装必要软件
install_packet () {
    yum -y install epel-release >/dev/null 2>&1
    yum -y install ntp ntpdate bash-completion net-tools wget lrzsz vim unzip gcc make openssl-devel iptables-services conntrack ipvsadm ipset jq curl sysstat libseccomp >/dev/null 2>&1
    [[ $? == 0 ]] && action "Yum Install Packet ..." /bin/true || action "Yum Install Packet ..." /bin/false
}

# 修改时区，可修改自己想要的时区
change_time () {
    timedatectl set-timezone $TimeZone
    timedatectl set-local-rtc 1    
    crontab -l > /tmp/crontab.bak
    ntpn=`cat /tmp/crontab.bak |grep "ntpdate"`
    if [[ $ntpn = "" ]]; then
        echo "add auto time update"
        echo "0 * * * * /usr/sbin/ntpdate ntp1.aliyun.com > /dev/null 2>&1" >> /tmp/crontab.bak
        crontab /tmp/crontab.bak
        action "Time Update ..." /bin/true
    else
        action "Ntpdate dont't Need Update  ..." /bin/true
    fi

}

# 优化内核参数
update_kernel () {
cat > /etc/sysctl.conf << EOF
net.bridge.bridge-nf-call-ip6tables=1
net.bridge.bridge-nf-call-iptables=1
net.ipv4.ip_forward=1
net.ipv4.conf.all.forwarding=1
net.ipv4.neigh.default.gc_thresh1=4096
net.ipv4.neigh.default.gc_thresh2=6144
net.ipv4.neigh.default.gc_thresh3=8192
net.ipv4.neigh.default.gc_interval=60
net.ipv4.neigh.default.gc_stale_time=120

# 参考 https://github.com/prometheus/node_exporter#disabled-by-default
kernel.perf_event_paranoid=-1

#sysctls for k8s node config
net.ipv4.tcp_slow_start_after_idle=0
net.core.rmem_max=16777216
fs.inotify.max_user_watches=524288
kernel.softlockup_all_cpu_backtrace=1
kernel.softlockup_panic=0
kernel.watchdog_thresh=30
fs.file-max=2097152
fs.inotify.max_user_instances=8192
fs.inotify.max_queued_events=16384
vm.max_map_count=262144
net.core.netdev_max_backlog=16384
net.ipv4.tcp_wmem=4096 12582912 16777216
net.core.wmem_max=16777216
net.core.somaxconn=32768
net.ipv4.ip_forward=1
net.ipv4.tcp_max_syn_backlog=8096
net.ipv4.tcp_rmem=4096 12582912 16777216
net.ipv6.conf.all.disable_ipv6=1
net.ipv6.conf.default.disable_ipv6=1
net.ipv6.conf.lo.disable_ipv6=1
vm.swappiness=0

# 可以控制core文件的文件名中是否添加pid作为扩展。
kernel.core_uses_pid=1

# Do not accept source routing
net.ipv4.conf.default.accept_source_route=0
net.ipv4.conf.all.accept_source_route=0

# Promote secondary addresses when the primary address is removed
net.ipv4.conf.default.promote_secondaries=1
net.ipv4.conf.all.promote_secondaries=1

# Enable hard and soft link protection
fs.protected_hardlinks=1
fs.protected_symlinks=1

# 源路由验证
# see details in https://help.aliyun.com/knowledge_detail/39428.html
net.ipv4.conf.all.rp_filter=0
net.ipv4.conf.default.rp_filter=0
net.ipv4.conf.default.arp_announce = 2
net.ipv4.conf.lo.arp_announce=2
net.ipv4.conf.all.arp_announce=2

# see details in https://help.aliyun.com/knowledge_detail/41334.html
net.ipv4.tcp_max_tw_buckets=5000
net.ipv4.tcp_syncookies=1
net.ipv4.tcp_fin_timeout=30
net.ipv4.tcp_synack_retries=2
kernel.sysrq=1
EOF
sysctl -p >&/dev/null
[[ $? == 0 ]] && action "Kernel Update ..." /bin/true || action "Kernel Update ..." /bin/false

}

# 禁用内存swap
disable_swap () {
    swapoff -a
    sed -i '/ swap / s/^\(.*\)$/#\1/g' /etc/fstab
    [[ $? == 0 ]] && action "Disable Swap ..." /bin/true || action "Disable Swap ..." /bin/false
}

# 修改limit
change_limit () {
    ulimit -SHn 65536
    LGREP=$(grep "soft" /etc/security/limits.conf |grep -v "^#")
    if [[ $LGREP = "" ]]; then
        echo "*               soft    nproc           65536" >> /etc/security/limits.conf
        echo "*               hard    nproc           65536" >> /etc/security/limits.conf
        echo "*               soft    nofile          65536" >> /etc/security/limits.conf
        echo "*               hard    nofile          65536" >> /etc/security/limits.conf
        action "Ulimit change ..." /bin/true
    else
        action "Ulimit don't need change ..." /bin/true
    fi

}

# 添加 ipvs modules
add_ipvs () {
modprobe br_netfilter
cat > /etc/sysconfig/modules/ipvs.modules << "EOF"
#!/bin/bash
ipvs_modules="ip_vs ip_vs_lc ip_vs_wlc ip_vs_rr ip_vs_wrr ip_vs_lblc ip_vs_lblcr ip_vs_dh ip_vs_sh ip_vs_fo ip_vs_nq ip_vs_sed ip_vs_ftp nf_conntrack_ipv4"
for kernel_module in ${ipvs_modules}; do
    /sbin/modinfo -F filename ${kernel_module} >/dev/null 2>&1
    if [[ $? == 0 ]]; then
        /sbin/modprobe ${kernel_module}
    fi
done
EOF
chmod 755 /etc/sysconfig/modules/ipvs.modules
bash /etc/sysconfig/modules/ipvs.modules
[[ $? == 0 ]] && action "Add ipvs Module ..." /bin/true || action "Add ipvs Module ..." /bin/false
}

# 安装Docker
install_docker () {
    if [[ ${Enable_docker} == "0" ]]; then
        yum install -y yum-utils device-mapper-persistent-data lvm2 >/dev/null 2>&1
        yum-config-manager --add-repo http://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo >/dev/null 2>&1
        yum install -y containerd.io-${Containerd_Version} docker-ce-${Docker_Version} docker-ce-cli-${Docker_Version} >/dev/null 2>&1
        systemctl start docker >/dev/null 2>&1
        systemctl enable docker >/dev/null 2>&1
        # Setup daemon.
        cat > /etc/docker/daemon.json << "EOF"
{
    "exec-opts": ["native.cgroupdriver=systemd"],
    "log-driver": "json-file",
    "log-opts": {
        "max-size": "100m",
        "max-file": "3"
    },
    "max-concurrent-downloads": 10,
    "max-concurrent-uploads": 10,
    "bip": "DockerBIP",
    "registry-mirrors": [
        "https://kfwkfulq.mirror.aliyuncs.com",
        "https://2lqq34jg.mirror.aliyuncs.com",
        "https://pee6w651.mirror.aliyuncs.com",
        "http://hub-mirror.c.163.com",
        "https://docker.mirrors.ustc.edu.cn",
        "https://registry.docker-cn.com"
    ],
    "storage-driver": "overlay2",
    "storage-opts": [
    "overlay2.override_kernel_check=true"
    ]
}
EOF
        sed -i "s#DockerBIP#${Docker_BIP}#g" /etc/docker/daemon.json
        mkdir -p /etc/systemd/system/docker.service.d
        # Restart docker.
        systemctl restart docker >/dev/null 2>&1
        [[ $? == 0 ]] && action "Docker Install ..." /bin/true || action "Docker Install ..." /bin/false
    fi

}

disable_selinxu
change_hosts
disable_firewalld
change_repo
install_packet
change_time
update_kernel
disable_swap
change_limit
add_ipvs
install_docker
exit 0